87 lines
2.4 KiB
YAML
87 lines
2.4 KiB
YAML
---
|
|
# CIS 1.4.x: AIDE (Advanced Intrusion Detection Environment) als
|
|
# Datei-Integritaets-Monitoring. Ergaenzt das Anwendungs-Audit-Log
|
|
# (manipulationssichere Hash-Chain, Konzept 6.1) um eine unabhaengige,
|
|
# dateisystemweite Kontrolle -- erkennt z.B. Aenderungen an Systembinaries
|
|
# oder eingeschleuste Dateien ausserhalb des Anwendungscodes.
|
|
|
|
- name: AIDE installieren
|
|
ansible.builtin.apt:
|
|
name: aide
|
|
state: present
|
|
update_cache: true
|
|
when: os_hardening_aide_enabled
|
|
|
|
- name: Pruefen, ob bereits eine AIDE-Datenbank existiert
|
|
ansible.builtin.stat:
|
|
path: /var/lib/aide/aide.db
|
|
register: _aide_db
|
|
when: os_hardening_aide_enabled
|
|
|
|
- name: Initiale AIDE-Datenbank aufbauen (kann einige Minuten dauern)
|
|
ansible.builtin.command: aideinit -y -f
|
|
when: os_hardening_aide_enabled and not _aide_db.stat.exists
|
|
async: 1800
|
|
poll: 30
|
|
|
|
- name: AIDE-Wrapper-Skript fuer den taeglichen Check ausrollen
|
|
ansible.builtin.copy:
|
|
dest: /usr/local/sbin/jumphost-aide-check.sh
|
|
owner: root
|
|
group: root
|
|
mode: "0750"
|
|
content: |
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
LOGFILE=/var/log/jumphost/aide-check.log
|
|
/usr/bin/aide.wrapper --check >> "$LOGFILE" 2>&1 || {
|
|
logger -p authpriv.warning "AIDE hat Dateisystem-Abweichungen gemeldet, siehe $LOGFILE"
|
|
}
|
|
when: os_hardening_aide_enabled
|
|
|
|
- name: systemd-Service fuer taeglichen AIDE-Check
|
|
ansible.builtin.copy:
|
|
dest: /etc/systemd/system/jumphost-aide-check.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
content: |
|
|
[Unit]
|
|
Description=Taeglicher AIDE-Dateiintegritaets-Check
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/sbin/jumphost-aide-check.sh
|
|
Nice=10
|
|
IOSchedulingClass=idle
|
|
when: os_hardening_aide_enabled
|
|
notify: reload systemd (os_hardening)
|
|
|
|
- name: systemd-Timer fuer taeglichen AIDE-Check
|
|
ansible.builtin.copy:
|
|
dest: /etc/systemd/system/jumphost-aide-check.timer
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
content: |
|
|
[Unit]
|
|
Description=Taeglicher AIDE-Dateiintegritaets-Check (Timer)
|
|
|
|
[Timer]
|
|
OnCalendar=daily
|
|
RandomizedDelaySec=3600
|
|
Persistent=true
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|
|
when: os_hardening_aide_enabled
|
|
notify: reload systemd (os_hardening)
|
|
|
|
- name: AIDE-Check-Timer aktivieren
|
|
ansible.builtin.systemd:
|
|
name: jumphost-aide-check.timer
|
|
daemon_reload: true
|
|
enabled: true
|
|
state: started
|
|
when: os_hardening_aide_enabled
|